Wasmtime's implementation of string transcoding to the Component Model's utf16 or latin1+utf16 encodings improperly verifies the alignment of reallocated strings. This improper validation allows unaligned pointers to be passed to the host environment, which triggers a host panic. Since the panic can be induced by malicious guest code transferring specific strings with particular memory addresses, this vulnerability constitutes a denial of service vector controlled by the guest. The vulnerability is identified as CWE-129 (Improper Validation of Array Index). It affects Wasmtime versions prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1 and is fixed in those versions.

The vulnerability allows a malicious guest component running in Wasmtime to cause a host panic by passing unaligned pointers during string transcoding. This panic leads to a denial of service condition in the host environment. There is no indication of code execution or data corruption beyond the DoS impact. No known exploits are reported in the wild.

Fixes for this vulnerability are available in Wasmtime versions 24.0.7, 36.0.7, 42.0.2, and 43.0.1. Users should upgrade to one of these fixed versions to remediate the issue. Patch status is not explicitly stated beyond these fixed versions, so users should verify their version against these and update accordingly. There is no vendor advisory content provided that states 'no action required' or 'already mitigated.'